In automation technology, so-called redundant controllers are used in applications which are designed with high availability, such as a tunnel monitoring system for example. Here, one control device, usually also referred to as a controller, controls the process and the other control device runs in standby mode in order to be able to take over control of the process on the occurrence of certain events. In doing so, the program sequence is reconciled between the control devices by means of a synchronization connection to enable the process to continue to be controlled in the same manner after a changeover. As well as this synchronization of the user program, other information is also exchanged between the control devices in order to ensure consistent operation. Each of the control devices must be informed of the state and function of the other in order to match its own sequence thereto.
By way of example, a redundant control system with control computers and a peripheral unit in which the control computers cyclically output alternating signs of life, wherein the peripheral unit switches to the respective other control computer in the absence of a change in the sign of life, is disclosed in DE 100 30 329 C1.
Further, a control and data transmission system having at least two control devices and at least one slave device which are connected to one another by means of a communications network is described in DE 10 2006 047 026 B4, wherein the slave device contains a plurality of addressable output interfaces for receiving output and status data, and each control device has a device for generating and transmitting status and output data to a separate output interface of the slave device, and wherein the slave device has an evaluation device which controls the forwarding of received output data for further use in response to the status signals received from the control devices.
In general, a redundant control system comprises two control devices, which are synchronized to one another, and subordinated input/output stations, which are connected to the two controllers by means of an appropriate communications network. Typically, one of the two control devices in each case assumes the role of the primary controller, while the other assumes the role of a reserve controller. If an error occurs in the primary controller, the control devices change their roles, i.e. the system switches to the reserve controller, which then becomes the primary controller.
For the purpose of error monitoring, control devices are frequently fitted with LEDs or displays comprising a few characters, by means of which the current operating state or an error state of the respective control device can be signaled.